Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
50
42
24
6
6
Contributors
44
35
20
9
6
Categories
59
44
20
9
7
Platforms
106
14
10
8
5
Products / Services
20
17
12
8
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
4
1
1
IDS Protocols
6
Commodity .NET keylogger and remote access trojan
Detects specific registry queries related to 'en-US' custom locale checks, often used by Grixba (Play Ransomware) to identify and evade sandbox environments. The rule also filters for process names matching known Grixba execution patterns or suspicious locations such as Public Music directories.
This rule detects the execution of common security analysis, reverse engineering, and debugging tools such as Process Hacker, IDA Pro, Wireshark, and various debuggers. While these tools are legitimate for development and troubleshooting, their presence in unexpected contexts may indicate reconnaissance or analysis activities by an adversary.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects evidence of anti-debugging techniques commonly associated with VILE Ransomware. The rule monitors process information including command lines, descriptions, and file paths for strings such as 'RtlGetCurrentPeb', 'taggedPointerPack', 'gcstoptheworld', and specific ransomware-related markers, indicating that a process is attempting to detect or evade analysis environments.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects process argument spoofing techniques to hide true command line from forensics
This rule detects the presence of anti-debugging techniques within HTTP payload data. Specifically, it looks for the strings "IsDebuggerPresent" and "ExitProcess" (case-insensitive) in the HTTP response body. The combination of these strings suggests that a malicious payload might be checking for a debugger and attempting to terminate if one is detected, a common defense evasion technique used by malware.
Detects malware using debugger detection APIs to evade dynamic analysis
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of timing-based anti-debugging techniques. It looks for the presence of "__rdtsc" (Read Time-Stamp Counter) and "ExitProcess" within the file data of an HTTP response, suggesting that a program might be attempting to detect a debugger by measuring execution time and exiting if debugging is detected. This is a common technique used by malware to evade analysis.
This rule detects the string "CheckRemoteDebuggerPresent" within HTTP response payloads. This string is associated with an anti-debugging technique used by malware to detect if it's being analyzed in a debugger environment. The rule specifically looks for this content in data flowing from the server to the client (flow:to_client,established; file.data;). The detection is case-insensitive (nocase).
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Detects modifications to the Image File Execution Options (IFEO) or SilentProcessExit registry keys, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries may use these mechanisms to attach debuggers or monitor programs to legitimate executables, causing malicious code to run when the target application starts or exits.
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
thx to Maurice Fielenbach for Sharing this Attack Path on Linkedin
Detects the execution of a Python interpreter with suspicious characteristics, such as running from a temporary location or using command-line arguments associated with obfuscation and in-memory execution. This behavior is consistent with Python-based stealers like Xillen Stealer.
Detects ScoringMathTea malware by identifying its custom in-line CRC32 table generation routine. This routine, used for integrity checks and anti-debugging, utilizes a unique polynomial constant (0x04C10DB7).
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Page 6 of 7